Roadmap

This is the public-safe summary of the plan. It is intent, not a delivery promise, and dates are deliberately absent — the order is the useful part.

Where things stand

The network product is built and running: the data path, the inventory, the detection models, the incident workflow, the optional analyst and the dashboard, including the destinations page and the address classes that keep local noise off the globe. The connector framework runs with six live read-only sources — UniFi, NetBox, Pi-hole, AdGuard Home, DHCP leases and Proxmox VE — and its first sink, the webhook, delivers incidents and health transitions outwards while GET /metrics exposes the appliance to Prometheus and Grafana; device naming resolves speaking names hourly from nine sources, a managed threat-intelligence refresh feeds the local indicator list, the online licence check and the telemetry client run against the live servers. Device identity phase one stays behind a feature flag that is off by default.

Response execution of a human approval ships in 0.31 for an OPNsense / pfSense pair and a UniFi controller, off by default.

What is not done: the purchase path, the automatic response mode and its live proofs, the mail module, the endpoint agent, and the open-source split of the repository itself.

The order

1. Finish the network product in operation. Live feeds, a started baseline, and the operational proofs that go with them: a tested restore, 24 hours of load observation, a controlled fault with catch-up, real alert and recovery delivery. The learning phase runs in parallel and cannot be compressed.

2. Connector framework and identity sources. The framework first — deliberately, because building connectors before the framework produces two shapes and the rebuild costs more than the original. Then the sources the identity model needs: DHCP leases (done — the DHCP leases connector reads Kea and ISC lease stores), and mDNS/SSDP names. Without those the inventory cannot keep a rotating device as one device, and everything downstream of the inventory is worth less.

3. Device identity. The full model, its timeline, merge candidates, the split endpoint, and the scheduled job. This is the critical path: today a device identifier can still be derived from an address, and that is the single largest correctness problem in the product.

4. Free/Pro foundation. The licensing model — the licence server, short-lived signed entitlement tokens, seat binding per installation, revocation at the next renewal and the 72-hour grace behaviour — is live, and so is the instance registry the seat binding depends on. The signed update channel with its rollback is in (upgrades). Still open: the capability registry, the extension protocol and the billing path.

5. Premium baseline and outputs. The remaining first-round connectors — hypervisor API, home automation, controller IDS and application classification — plus the outputs that make the product usable without watching it. The webhook, the metrics endpoint and the chat notifications for Telegram, Discord, Slack and Matrix are in; a mail sink reuses the same event path and follows. The free threat-intelligence feeds are in (threat intelligence), and so is the first phase of the server-side Pro value — the signed feed bundle, signed model packs and the analyst quota (Pro content); a presigned, licence-bound download is the stated next step there.

6. Open-source split and publication. Separating site-specific data into a private repository, extracting the Pro modules behind interfaces with a disabled fallback, a cleaned export with new history and a secret scan over that history, a reproducible installation and a demo that needs no real network, and an extension SDK with reference implementations.

7. Response executor. Built in 0.31: the firewall companion, the standby-first executor, the two targets, release and expiry — every human approval executes in proposal mode. Built in 0.32: the producer for the automatic mode, the identity proof, the evidence classes with their own confidence, response feedback and the calibration gate with its learning phase until 2026-09-24. What remains is the acceptance: the seven proofs on an isolated firewall pair, then a live canary against an address the operator owns; the automatic mode stays off until auto_enabled is set and the gate opens on real verdicts. Still open behind it: calibration per behaviour signature rather than one gate per tenant, a feedback form in the dashboard, and identity_merge proposals from the identity work. See automatic response.

8. Email security, phase one. Read-only first: real inbound and outbound mail events, rejections, authentication verdicts and aggregate reports, tenant-bound. Quarantine and blocking are a write path into a mail server and wait for phase one to be accepted.

9. Asset depth without an agent. A fact model where every fact carries its source, confidence and age; passive derivation; layer-2 inventory sources; behaviour groups with a self-comparison fallback. Its success criterion is measured, not assumed: if peer groups do not demonstrably reduce false alarms after two weeks, the feature stays off.

Deliberately not in the next twelve months

Topic	Why
Managed multi-tenant hosting for third parties	Needs dedicated nodes, resolved single points of failure and a data-processing agreement. Only sensible after direct customers exist.
Endpoint agent	The largest potential gain, but only once identity, facts and billing stand.
Mail quarantine and blocking	A write path into a mail server. Only after phase one is accepted.
Local vulnerability matching	Depends on the agent.

Longer-term detection work

These need four to eight weeks of real data before they can be evaluated at all, so they follow the statistical layer rather than replacing it:

• Bayesian baselines instead of exponential smoothing, giving a probability rather than a z-score.
• Per-group autoencoders on hourly features, using reconstruction error as an anomaly score. At a few hundred devices the appliance’s own CPU can train these overnight, once a week. A GPU would accelerate it; it is not a requirement.
• A small sequence model over the order of services and destinations, for chains such as scan, then file share, then upload.
• Embeddings, for “similar cases” and “devices that behave like this one”.

Principles that constrain all of it

• A model never blocks by itself.
• The cheap path first; the expensive one only on reported uncertainty or human escalation.
• Every model output records its model, prompt version and evidence.
• Features are judged against measured benefit relative to the detection that already exists. A feature with no measurable benefit is removed, not kept for the feature list.